Executive brief
A vulnerability in the Linux kernel's Device Mapper component could allow a local user to cause a system crash or potentially access sensitive information. The issue occurs when the system handles corrupted storage metadata, leading to a 'double release' error that halts the operating system. This affects systems using specific storage configurations like dm-cache or dm-array.
Technical details
A double-free vulnerability (CWE-672) exists in the dm-array component of the Linux kernel. When dm_bm_read_lock() encounters a locking or checksum error, it implicitly releases the block but leaves an invalid pointer in the output parameter. The dm_array_cursor incorrectly caches this invalid pointer, leading to a second release attempt in dm_array_cursor_end(). This triggers a BUG_ON in the dm-bufio cache_put() function. An attacker with local privileges could exploit this by providing specially crafted or corrupted storage metadata to trigger a kernel crash. The fix ensures the cached block pointer is set to NULL upon encountering errors.
Affected products
- Linux Linux Kernel 4.9 to 5.4.290, 5.5 to 5.10.234, 5.11 to 5.15.177, 5.16 to 6.1.125, 6.2 to 6.6.72, 6.7 to 6.12.10, 6.13-rc1 to 6.13-rc6
Timeline
- 2024-12-05: other: Patch authored
- 2025-01-17: patched: Patch committed to stable branches
- 2025-01-19: advisory: CVE published
References
- https://git.kernel.org/stable/c/017c4470bff53585370028fec9341247bad358ff
- https://git.kernel.org/stable/c/6002bec5354f86d1a2df21468f68e3ec03ede9da
- https://git.kernel.org/stable/c/738994872d77e189b2d13c501a1d145e95d98f46
- https://git.kernel.org/stable/c/9c7c03d0e926762adf3a3a0ba86156fb5e19538b
- https://git.kernel.org/stable/c/e477021d252c007f0c6d45b5d13d341efed03979
- https://git.kernel.org/stable/c/f2893c0804d86230ffb8f1c8703fdbb18648abc8
- https://git.kernel.org/stable/c/fc1ef07c3522e257e32702954f265debbcb096a7